What would the filter expression be to just select the protocols where the protocol = TLSV1?
Something obvious like protocol == "TLSV1" or TCP.protocol == "TLSV1" is apparently not the right way.

ip.proto == "TLSV1" says "ip.proto cannot accept strings as values"

Update - additional tips:

Another great but hidden search is on PacketLength:
You can add packet length to your display by clicking "Edit Preferences" (menu or icon), and adding the PacketLength as a new column, but to filter on it you have to use the more cryptic: frame.len == ### where ### is your desired number. We were using this to determine how many packets had been sent and/or received, when you filter, the status-bar at the bottom of the screen shows the number of items matching the filter.

Wow, thanks! Seems like one could filter on the words on the screen instead of the crypto codes.
–
NealWaltersDec 28 '10 at 21:45

"ip.proto == 6"was somewhat close to what I wanted (but gives SMB and TCP as well as TLSV1)
–
NealWaltersDec 28 '10 at 21:47

1

"ip.proto" refers to the "Protocol" field in the IP header: wireshark.org/docs/dfref/i/ip.html. "ip.proto == 6" means "Any TCP packet carried over IPv4". Most of Wireshark's display filters correspond to a numeric value in a given protocol header.
–
Gerald CombsDec 29 '10 at 0:39